[Dovecot-news] v2.2.34 released



  • CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be reached
    and the process restarted. This happens only if Dovecot config has
    local_name { } or local { } configuration blocks and attacker uses
    randomly generated SNI servernames.
  • CVE-2017-14461: Parsing invalid email addresses may cause a crash or
    leak memory contents to attacker. For example, these memory contents
    might contain parts of an email from another user if the same imap
    process is reused for multiple users. First discovered by Aleksandar
    Nikolic of Cisco Talos. Independently also discovered by "flxflndy"
    via HackerOne.
  • CVE-2017-15132: Aborted SASL authentication leaks memory in login
  • Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team. Nowadays
    core dumps can be safely enabled by using “sysctl -w
    fs.suid_dumpable=2”. If the old behaviour is wanted, it can still be
    enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  • doveconf output now includes the hostname.
  • mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  • imap: Support fetching body snippets using FETCH (SNIPPET) or
  • fs-compress: Automatically detect whether input is compressed or not.
    Prefix the compression algorithm with “maybe-” to enable the
    detection, for example: “compress:maybe-gz:6:…”
  • Added settings to change dovecot.index* files’ optimization behavior.
    See https://wiki2.dovecot.org/IndexFiles#Settings
  • Auth cache can now utilize auth workers to do password hash
    verification by setting auth_cache_verify_password_with_worker=yes.
  • Added charset_alias plugin. See
  • imap_logout_format and pop3_logout_format settings now support all of
    the generic variables (e.g. %{rip}, %{session}, etc.)
  • Added auth_policy_check_before_auth, auth_policy_check_after_auth
    and auth_policy_report_after_auth settings.
  • v2.2.33: doveadm-server: Various fixes related to log handling.
  • v2.2.33: doveadm failed when trying to access UNIX socket that didn’t
    require authentication.
  • v2.2.33: doveadm log reopen stopped working
  • v2.2.30+: IMAP stopped advertising SPECIAL-USE capability
  • v2.2.30+: IMAP stopped sending untagged OK/NO storage notifications
  • replication: dsync sends unnecessary replication notification for
    changes it does internally. NOTE: Folder creates, renames, deletes
    and subscribes still trigger unnecessary replication notifications,
    but these should be rather rare.
  • mail_always/never_cache_fields setting changes weren’t applied for
    existing dovecot.index.cache files.
  • Fix compiling and other problems with OpenSSL v1.1
  • auth policy: With master user logins, lookup using login username.
  • FTS reindexed all mails unnecessarily after loss of
    dovecot.index.cache file
  • mdbox rebuild repeatedly fails with “missing map extension”
  • SSL connections may have been hanging with imapc or doveadm client.
  • cassandra: Using protocol v3 (Cassandra v2.1) caused memory leaks and
    also timestamps weren’t set to queries.
  • fs-crypt silently ignored public/private keys specified in
    configuration (mail_crypt_global_public/private_key) and just
    emitted plaintext output.
  • lock_method=dotlock caused crashes
  • imapc: Reconnection may cause crashes and other errors

Dovecot-news mailing list